Hi,
I have events similar to this example:
1) date1, id1, misc
2) date2, id2, misc
3) date3, , misc
4) date4, id3 and id4, misc
The ids in 4) should be split into two separate lines. The...
See more...
Hi,
I have events similar to this example:
1) date1, id1, misc
2) date2, id2, misc
3) date3, , misc
4) date4, id3 and id4, misc
The ids in 4) should be split into two separate lines. The result should look like this:
1) date1, id1, misc
2) date2, id2, misc
3) date3, , misc
4) date4, id3 , misc
5) date4, id4, misc
But when using makemv with tokenizer lines which do not match, the tokenizers are skipped in the result, e.g.:
... | makemv tokenizer="(id\d)" ID | mvexpand ID | ...
Results in:
1) date1, id1, misc
2) date2, id2, misc
3) date4, id3 , misc
4) date4, id4, misc
How can I keep the non-matching lines? Is there a way to only use makemv where it is necessary?
My workaround at the moment is to append a second search that looks for events with an empty ID and adds those events again after the makemv, e,g,:
first search | ... | makemv tokenizer="(id\d)" ID | mvexpand ID | append [ first search again | ... | search NOT ID="*" | ... ] | ...
But searching twice can't be an optimal solution.
Thank you,
Gunnar